There are many stories in the news these days regarding companies that were breached, customer data exposed, fines levied – it’s becoming a commonplace occurrence.
Both large and small businesses can be a target for cyber criminals. In fact, some types of cyber-crime such as Ransomware have become such a lucrative market that they are now offered on the darkweb as RaaS (Ransomware as a Service), complete with its own support staff and payment systems. The nature of these attacks has evolved significantly over recent years; as the Anti-Virus and Endpoint Detection and Response capabilities have improved, malware (as used historically) is becoming harder to deploy at scale. Threat actors are instead moving to a model where infection and encryption of data is not the only method to extort companies. Instead, while still trying to encrypt company data, they also steal it so that they can blackmail companies into paying them and prevent them from releasing the data publicly.
This change of tactic significantly changes the landscape for every company. Now, it only takes one mistake by one user and everything that an employee has access to can be used in an extortion campaign. Since every airport will hold confidential data that it doesn’t want in the public domain – employee details, customer details, research – every company is a valid target.
The Verizon Data Breach Investigations Report (DBIR) is released every year and offers an invaluable insight into the current threat landscape and emerging trends. The 2024 release details the 180% increase for exploitation of vulnerabilities being the initial point of compromise, which is almost triple on the previous year [1]. The origin of these vulnerabilities being exploited was, perhaps unsurprisingly, typically via web applications. Many of these vulnerabilities can be exploited automatically as soon as they are discovered by a threat actor or their tooling.
Penetration testing can help identify weaknesses in security practices and vulnerabilities before the threat actors do, allowing time to fix them before they are exploited. While a penetration test will not find every possible past, current and future vulnerability affecting an organisation, it will help harden them to attack. This will make a successful attack a lot less likely, a lot harder to achieve and require a lot more time and effort on the threat actor’s end, allowing businesses more time to detect and respond to the incident.
Any organisation can benefit from a penetration test; if holding or processing sensitive data, it’s potentially a target to a threat actor. However, there is the cost to be considered – penetration tests are not inexpensive, and reducing the cost by arbitrarily reducing the day count for the engagement is typically not an advisable approach, as it could result in parts of the scope being skipped, which can leave important but unchecked areas of the estate vulnerable. It is therefore recommended to set budget aside each year for cyber security, of which penetration testing should be a component, and that scoping is performed in collaboration with a penetration testing partner. This will help to ensure the organisation gets the best value possible from the engagement.
Once scoping has been agreed, there will be some steps that the business needs to take. The penetration testing partner should provide guidance on how to go about preparation, but there are some general actions that should be considered:
The nature of the work will depend heavily on the scope agreed and the type of testing being performed. However, at a high level, scans will be run to gather a baseline of hosts on the network, services running on those hosts and known vulnerabilities affecting the discovered services. After the baseline scans have taken place, the approach switches to a manual one, where the consultant will be looking at each host and service individually to identify misconfigurations and vulnerabilities that may be present. For web applications this goes into a much deeper review on an application layer for the web services, looking for common and extremely dangerous vulnerabilities in both off-the-shelf and custom-built web applications, no matter what the technology stack is.
Should the internal network be in scope, this would also include a review of the Active Directory (AD). Attempts to use weaknesses in account, group and AD permissions to move laterally onto other machines and escalate privilege can also feature as part of the testing activity.
Once the penetration test has completed and the report has been presented, this is the natural time for the organisation to assess the holistic picture. This includes reviewing all aspects of the penetration test and identifying trends and urgent actions as a result of the outcome.
The urgent actions are generally a lot easier to identify than trends, and the penetration testing partner can suggest the best way to prioritise issues. Typically, this will be given by a rating system in the report, but it’s best practice to review and discuss the next steps. A typical approach is to work from the highest severity down when considering priority for remediation, but access should also be considered – if a vulnerability is internet facing and high severity it may be more pressing than an internal critical vulnerability, just due to the restricted access. A strong technical understanding is key in appreciating the nature of a vulnerability, and the penetration testing partner should be able to help an organisation process the findings and their urgency.
Less urgent but important vulnerabilities can also be established from the report. For example, one missing patch may not constitute a problematic trend. However, if there are several End-of-Life systems discovered and multiple patches missing across many hosts in the estate, this could indicate that the organisation’s patch policy may need attention. These can sometimes be hard to identify but reviewing with the consultant who performed the test can provide expert insight on general advice for improving practices moving forwards.
In conclusion, penetration testing is relevant for all business types and sizes, and it will deliver significantly more value than an automated scan could alone. It should identify vulnerabilities, as well as weaknesses in practices and gaps in policies to help the organisation remain resilient long after the engagement has ended and the urgent fixes applied. Discover how we can help support your businesses cybersecurity endeavours here.
[1] https://www.verizon.com/business/en-gb/resources/reports/dbir/2024/summary-of-findings/
© 2025 | Oxford Systems
5 Minton Place, Victoria Road, Bicester, Oxfordshire, OX26 6QB, United Kingdom
cyber@oxfordsystems.co.uk